Merge branch 'fix-raw-controller-disposition' into 'master'

Remove the filename argument from Content-Disposition header

This MR removes the filename argument from the `Content-Disposition` header to avoid RFC 5987 and RFC 6266 encoding issues. Some browsers (e.g. Internet Explorer) do not properly decode a Unicode string properly, and this can lead to odd filenames in the raw file download. This change allows the browser to determine the filename based on the URL.

For example, if I have a file called `한글한글.pptx` and click to download it with the "Raw" button in the Files section, IE11 will ask:

![image](https://gitlab.com/stanhu/gitlab-ce/uploads/fdb688282c0d4564872deadb44c58b2c/image.png)

If you look at the `Content-Disposition` field, you see this:

![image](https://gitlab.com/stanhu/gitlab-ce/uploads/2b342b83ae1ec61fd31937163ace8ec5/image.png)

Chrome, Firefox, and Safari seem to be able to handle UTF-8 encoded filenames, even though this is not standard.

See: http://greenbytes.de/tech/tc2231/

Closes https://github.com/gitlabhq/gitlabhq/issues/9595

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/1829

I've also submitted a pull request to Rails to support RFC 6266: https://github.com/rails/rails/pull/21461

See merge request !1235

3 files changed, 25 insertions, 2 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 0c401a99d48..e46fb5d6c1e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 Please view this file on the master branch, on stable branches it's out of date.
 
 v 8.0.0 (unreleased)
+  - Omit filename in Content-Disposition header in raw file download to avoid RFC 6266 encoding issues (Stan HU)
   - Prevent anchors from being hidden by header (Stan Hu)
   - Fix bug where only the first 15 Bitbucket issues would be imported (Stan Hu)
   - Sort issues by creation date in Bitbucket importer (Stan Hu)
diff --git a/app/controllers/projects/raw_controller.rb b/app/controllers/projects/raw_controller.rb
index 647c1454078..1a3df40dc75 100644
--- a/app/controllers/projects/raw_controller.rb
+++ b/app/controllers/projects/raw_controller.rb
@@ -17,8 +17,7 @@ class Projects::RawController < Projects::ApplicationController
       send_data(
         @blob.data,
         type: type,
-        disposition: 'inline',
-        filename: @blob.name
+        disposition: 'inline'
       )
     else
       not_found!
diff --git a/spec/controllers/projects/raw_controller_spec.rb b/spec/controllers/projects/raw_controller_spec.rb
new file mode 100644
index 00000000000..1f921d5f05d
--- /dev/null
+++ b/spec/controllers/projects/raw_controller_spec.rb
@@ -0,0 +1,23 @@
+require 'spec_helper'
+
+describe Projects::RawController do
+  let(:public_project) { create(:project, :public) }
+
+  describe "#show" do
+    context 'regular filename' do
+      let(:id) { 'master/README.md' }
+
+      it 'delivers ASCII file' do
+        get(:show,
+            namespace_id: public_project.namespace.to_param,
+            project_id: public_project.to_param,
+            id: id)
+
+        expect(response.status).to eq(200)
+        expect(response.header['Content-Type']).to eq('text/plain; charset=utf-8')
+        expect(response.header['Content-Disposition']).
+            to eq("inline")
+      end
+    end
+  end
+end